Overview

overview

10

Static

static

3

45fb50b593...52.exe

windows7-x64

10

45fb50b593...52.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2024 21:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45fb50b593faf530aa26cfd2e5ba7e3b0744ae9b7e6921c6aa8021ed7f90f452.exe

  • Size

    1.8MB

  • MD5

    2d19492cf956ebf1ce662e5912b07367

  • SHA1

    dea9da4251fefcf2d49759177f89675fb4ed32b9

  • SHA256

    45fb50b593faf530aa26cfd2e5ba7e3b0744ae9b7e6921c6aa8021ed7f90f452

  • SHA512

    ae1649fff4f87322a54c6394e1ebd0439201648bc88fd5f9984bd0e88ef690c16c5957f18afd4b290a435f8778cd9f96328c2ab570b5dfd5c834fcae25c0b749

  • SSDEEP

    49152:fjR6USUBfqc1I3Dk711hKTu75O5AEF+qJtXcmoR:fj9/yI71TKTaQaEYmX

Score
10/10
amadeycryptbotlummaredlinestealc9c9aa5default_valencigadomafed3aatg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasionexecutioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 43 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\45fb50b593faf530aa26cfd2e5ba7e3b0744ae9b7e6921c6aa8021ed7f90f452.exe
    "C:\Users\Admin\AppData\Local\Temp\45fb50b593faf530aa26cfd2e5ba7e3b0744ae9b7e6921c6aa8021ed7f90f452.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 148
            5⤵
            • Program crash
            PID:2832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 96
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2824
      • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2672
          • C:\Users\Admin\AppData\Roaming\lcnRyr8Vnr.exe
            "C:\Users\Admin\AppData\Roaming\lcnRyr8Vnr.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3008
          • C:\Users\Admin\AppData\Roaming\c9rrMHmaPi.exe
            "C:\Users\Admin\AppData\Roaming\c9rrMHmaPi.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 52
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1876
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:668
      • C:\Users\Admin\AppData\Local\Temp\1000354001\8ee2c132a5.exe
        "C:\Users\Admin\AppData\Local\Temp\1000354001\8ee2c132a5.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1284
      • C:\Users\Admin\AppData\Local\Temp\1000355001\db619452f1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000355001\db619452f1.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:1804
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1784
          • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
            "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2836
          • C:\Users\Admin\AppData\Local\Temp\1000349001\aa40b2545f.exe
            "C:\Users\Admin\AppData\Local\Temp\1000349001\aa40b2545f.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:1880
          • C:\Users\Admin\1000350002\3286c94e2b.exe
            "C:\Users\Admin\1000350002\3286c94e2b.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2888
          • C:\Users\Admin\AppData\Local\Temp\1000357001\ab31b03430.exe
            "C:\Users\Admin\AppData\Local\Temp\1000357001\ab31b03430.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Windows security modification
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2236
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000360041\do.ps1"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2792
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
              6⤵
                PID:2956
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
                  7⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1596
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.0.1972055435\385771605" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dfed307-41e6-4e03-83af-60254d3afc0d} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 1296 100deb58 gpu
                    8⤵
                      PID:1872
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.1.1924065361\700623357" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dea30c59-8194-46a9-a4ee-b24344a594e9} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 1500 d70a58 socket
                      8⤵
                        PID:2372
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.2.98347751\1302932176" -childID 1 -isForBrowser -prefsHandle 2072 -prefMapHandle 2068 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4478b93e-8013-4bdf-afbb-fe462b337f0b} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 2084 1005ea58 tab
                        8⤵
                          PID:844
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.3.138238491\1491105135" -childID 2 -isForBrowser -prefsHandle 2728 -prefMapHandle 2724 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {048e8b0b-036a-4715-ab21-8a7d5593988b} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 2740 d62258 tab
                          8⤵
                            PID:2652
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.4.532677414\177117483" -childID 3 -isForBrowser -prefsHandle 3824 -prefMapHandle 3820 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebae245a-ea35-4edc-9e98-971000596545} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 3840 20658258 tab
                            8⤵
                              PID:3620
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.5.1576663083\838433066" -childID 4 -isForBrowser -prefsHandle 3960 -prefMapHandle 3964 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60c52692-3c78-4d7e-852c-678f45802e76} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 3952 206cd158 tab
                              8⤵
                                PID:3628
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1596.6.1438394431\473868140" -childID 5 -isForBrowser -prefsHandle 4132 -prefMapHandle 4136 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {811fa0b6-28bc-4b72-aa20-c3e9764548e0} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" 4124 206cd758 tab
                                8⤵
                                  PID:3644
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                            5⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1840
                      • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:1356
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies system certificate store
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2068
                      • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        PID:2908
                        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                          "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:2788
                          • C:\Users\Admin\AppData\Local\Temp\1000086001\JavUmar.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000086001\JavUmar.exe"
                            5⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2688
                      • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3064
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c start context.exe
                          4⤵
                            PID:3460
                            • C:\Users\Admin\AppData\Local\Temp\context.exe
                              context.exe
                              5⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3576
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 728
                                6⤵
                                • Loads dropped DLL
                                • Program crash
                                PID:3500
                        • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
                          3⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2140
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                            4⤵
                              PID:2948
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2336
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3840
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im "InstallUtil.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3984
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 1
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  • Delays execution with timeout.exe
                                  PID:4072

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Defense Evasion

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      4
                      T1552

                      Credentials In Files

                      4
                      T1552.001

                      Discovery

                      Query Registry

                      6
                      T1012

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        Filesize

                        342B

                        MD5

                        2dfa55b4ff1fc8d5e6cd5567b9284e78

                        SHA1

                        c5c13a441e8adee8c77b2fa88eb8e65caf204909

                        SHA256

                        ad3d0196e7101b06a2e15cd44cb1a560cf2892f6b403e52e9af9354f8432b904

                        SHA512

                        c7cf4538828c4e92b4c8ff6cb2f00315fe26d692712add3b51731b9e7ee6239ad00a0723cbd322291730ac25d0e65f08ee8aa6df8216d065fa7fa47581d36395

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhg31lui.default-release\activity-stream.discovery_stream.json.tmp
                        Filesize

                        23KB

                        MD5

                        8b370f66265cd81c3999a96cdaa7d8f7

                        SHA1

                        b57330ba10c4104011212d95cc0f0dd64651f654

                        SHA256

                        226f7c364d92765ecc976cba2271c40122ba8a92fd140d6752aab942e3b7a5f1

                        SHA512

                        5a6fcf70675c00623abc51410a06944109bd9fe25eccf61a7fd6c83b8acaf823ea6ba7083d56c0cf4ed215749e8a7695af38fe069d45a7fcd7d65afc72a84458

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                        Filesize

                        566KB

                        MD5

                        049b6fe48a8cfb927648ad626aba5551

                        SHA1

                        9555d23104167e4fad5a178b4352831ce620b374

                        SHA256

                        b78402483c46cd37e2c204d95690aa2a213616a1f904d779ceec0e22fcdd6531

                        SHA512

                        ed787f90966ca1ea4b1e67c4026dd44393c7d312cd52e376f4ba5e5c49616938ec9e913044def29b40b441eb4c913a5134bb78317a179f62067bef3f9d913c7e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
                        Filesize

                        1.4MB

                        MD5

                        e6d27b60afe69ac02b1eaec864c882ae

                        SHA1

                        a72b881867b7eaa9187398bd0e9e144af02ffff4

                        SHA256

                        aac36ff20ea7bfc0591c1d6b145b456bad394ee8e619343ec10d1809188edd75

                        SHA512

                        4f11fc2b36589fc9ff7dc5afd27cb91614f6a89bfd60942baebef025f53cb56ed7413abeff57fc7c85b3a2a4b0feec2649d5c5a856d3e2e9c13f6a0d8c777764

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                        Filesize

                        307KB

                        MD5

                        68a99cf42959dc6406af26e91d39f523

                        SHA1

                        f11db933a83400136dc992820f485e0b73f1b933

                        SHA256

                        c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                        SHA512

                        7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000086001\JavUmar.exe
                        Filesize

                        7.2MB

                        MD5

                        3195fa517818ae805403fc975213e9b4

                        SHA1

                        43f5dbcd65c3e8fcbf106f4acd95ee26acd5c5ac

                        SHA256

                        d8689dcc36f611d77d6f6d1eb1ed8b872104a38568740936209114835a441048

                        SHA512

                        8c6036e280f7d201563ad0d7cf6050d581641741ce2a9a1380ceddae6791ea8ec73b49e6f3ba2ecca912dc8bdace75d43874d3e59699d22a46108c727650f17d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
                        Filesize

                        307KB

                        MD5

                        791fcee57312d4a20cc86ae1cea8dfc4

                        SHA1

                        04a88c60ae1539a63411fe4765e9b931e8d2d992

                        SHA256

                        27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

                        SHA512

                        2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000349001\aa40b2545f.exe
                        Filesize

                        1.8MB

                        MD5

                        d19345cd180657fc5e0f539927f4706b

                        SHA1

                        6ac5758e35620fdfef31f4bc80eba03fff331788

                        SHA256

                        0ca0ec137646d7269694093511a02f57650d7c35b40d6a403a935582931a546d

                        SHA512

                        9304640806230190f286d06429b425b572dc7b81b715e0e0001d209a3ca529185e7c6e52e0948e5d56f749854a81b70e9cb80d86ce31246b284aa7520e061cef

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000354001\8ee2c132a5.exe
                        Filesize

                        1.8MB

                        MD5

                        5dfa05b60c45476fdd8f39b1e93fc8a1

                        SHA1

                        06a4d1a3410b1e6909e22025aab5de356469d950

                        SHA256

                        1507aa5ff5c2a39351daed1d71ea68d1f069f3f6c4cacd11fffc27173cb6f495

                        SHA512

                        05755a8d7c23a5f160c0cc3a7f43303638e7b83542808257de88539e56955678a234d738f7f9b291ef8d4c0929cc9228e9f495840c7b89855c115c06a250b0d8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000355001\db619452f1.exe
                        Filesize

                        1.8MB

                        MD5

                        9d56af6516a7e9070041d692733b7a2d

                        SHA1

                        64e80f2c78f94c696b0dfd74a9b9904a785bb7be

                        SHA256

                        699ecf232e1e83f0518f035771c993bdf4a2937753e7f939b9bc7cda7b928a63

                        SHA512

                        5bb0853dc3e95613158f2147c8fc74e9ba3df5ae9b5809ac250eba5325f812b06784b216130a60ed560f1a7dd21abee24dc465ad671485fd9bcc467681ffd4bf

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000357001\ab31b03430.exe
                        Filesize

                        1.6MB

                        MD5

                        9f875cd80ee26b55a71c2f795eb01c33

                        SHA1

                        e71f7e13477c83c59c50cb975c3d893dae12d2ff

                        SHA256

                        a599f8e501bc4a1a7f1ed10b05b5b6fe4c6f13c40c1065af952740880123bfb9

                        SHA512

                        811ab159ef2868b6458f53784e639020eff3411f5063d76497d91a519ed78976e139d9deb726aef6acf2c6cc06838abf302875905dc9d4c1ef4f5e8802602394

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000360041\do.ps1
                        Filesize

                        2KB

                        MD5

                        65d1b33f6758ea511e3ed01f2cb74e53

                        SHA1

                        efa0e4d34c0d9bc719ef98ed5e145d8e50164916

                        SHA256

                        233dc91536e57adbb2153512f56f098db701e43a7768508c9e9f290c952f1319

                        SHA512

                        2772e2659aa2ffb6f86b1198d2a1652d7cb7a07ccfb249a96f7cb649594ba5ab1cc44389d505c9aca9f6ad9afda59d2abc565db5ae89b77f675155afe069103d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
                        Filesize

                        314KB

                        MD5

                        ff5afed0a8b802d74af1c1422c720446

                        SHA1

                        7135acfa641a873cb0c4c37afc49266bfeec91d8

                        SHA256

                        17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

                        SHA512

                        11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
                        Filesize

                        416KB

                        MD5

                        f5d7b79ee6b6da6b50e536030bcc3b59

                        SHA1

                        751b555a8eede96d55395290f60adc43b28ba5e2

                        SHA256

                        2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                        SHA512

                        532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
                        Filesize

                        6KB

                        MD5

                        c042782226565f89ce3954489075e516

                        SHA1

                        256dd5ba42837a33c7aa6cb71cef33d5617117ee

                        SHA256

                        a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

                        SHA512

                        9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
                        Filesize

                        1.1MB

                        MD5

                        ed9393d5765529c845c623e35c1b1a34

                        SHA1

                        d3eca07f5ce0df847070d2d7fe5253067f624285

                        SHA256

                        53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

                        SHA512

                        565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\CabBEFB.tmp
                        Filesize

                        70KB

                        MD5

                        49aebf8cbd62d92ac215b2923fb1b9f5

                        SHA1

                        1723be06719828dda65ad804298d0431f6aff976

                        SHA256

                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                        SHA512

                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\TarBF3D.tmp
                        Filesize

                        181KB

                        MD5

                        4ea6026cf93ec6338144661bf1202cd1

                        SHA1

                        a1dec9044f750ad887935a01430bf49322fbdcb7

                        SHA256

                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                        SHA512

                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\TmpCC93.tmp
                        Filesize

                        2KB

                        MD5

                        1420d30f964eac2c85b2ccfe968eebce

                        SHA1

                        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                        SHA256

                        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                        SHA512

                        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        8.0MB

                        MD5

                        a01c5ecd6108350ae23d2cddf0e77c17

                        SHA1

                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                        SHA256

                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                        SHA512

                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\db\data.safe.bin
                        Filesize

                        2KB

                        MD5

                        b28a39ad7a5beccccae27e554356e45d

                        SHA1

                        bd3f8464525b263cb804083af89459681c96c0b7

                        SHA256

                        8e91248df17c42ae589fb22f6cd54150c7e431c5a848c9896ef57acea8ac339f

                        SHA512

                        84df7953da05848297e41f6fa119e94e63bb6b9ff7b97773098fd3baff08f366b1c67181900e29fcdc0c9259d4126cae11a1a612d5cefc93e6c28badbdda80b7

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\15ddb009-bce4-4968-97cf-e89939dd2363
                        Filesize

                        11KB

                        MD5

                        317d56c92efca1742f3a44f6d93cc758

                        SHA1

                        41250011893cd496bcea86ef4577158b7d6d88fe

                        SHA256

                        15eeed686104d5b4013514959b09651324cf75e2eeb077883bc7eca60719ccc3

                        SHA512

                        c7afdec726d349f2ac9b2e5e26ff8b1fb3731a24c41c38a60e3b4f79bf32567ccac08ce3b1e3003c5fd62249c34c637fb2ba2101e658d0a73f6211401bddf3ba

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\datareporting\glean\pending_pings\8b7e9c1f-4fdc-4a9f-b0ab-58a358b866b1
                        Filesize

                        745B

                        MD5

                        7a3bc4966833390daa5320323930d214

                        SHA1

                        f732536be8d7fd773ca2aaa04f9d16a31569b513

                        SHA256

                        d5d7b15eb21a2239478d3365ffd46f37e92a6addcfe68f023af833f03456538b

                        SHA512

                        8df3d277047530c6ac0ed1758d71f33eef83e892c73ede17a76ef170a0bbda5348ae9468fb8572e0b9fd6b76d4e19c0e1ee62796ea7c927d70882d716a9677e8

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                        Filesize

                        372B

                        MD5

                        8be33af717bb1b67fbd61c3f4b807e9e

                        SHA1

                        7cf17656d174d951957ff36810e874a134dd49e0

                        SHA256

                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                        SHA512

                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                        Filesize

                        11.8MB

                        MD5

                        33bf7b0439480effb9fb212efce87b13

                        SHA1

                        cee50f2745edc6dc291887b6075ca64d716f495a

                        SHA256

                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                        SHA512

                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                        Filesize

                        1KB

                        MD5

                        937326fead5fd401f6cca9118bd9ade9

                        SHA1

                        4526a57d4ae14ed29b37632c72aef3c408189d91

                        SHA256

                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                        SHA512

                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs-1.js
                        Filesize

                        7KB

                        MD5

                        1e2d42b9d8d33113e73fe6fbc2dccdab

                        SHA1

                        5592807e081be6c9e42d3f14fbdfa16f5ce43d31

                        SHA256

                        f60c5c00248924b35237ad05bea9eacaeb4141e505532cd088e44023ef078c7d

                        SHA512

                        cbf58869a0ac66a4c7dbe0cee7f9742b61c039434913dac7dd7815c41a18f2ac2df9a766b47407c5f9341b72adceab77d471a50903f43913c41755d6cc4c38e8

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs-1.js
                        Filesize

                        7KB

                        MD5

                        7a540b92e84741cf80f6fbfc15583fdd

                        SHA1

                        60d270b6eca3f66c3e2ce2bcdf9fb4ef0a2ab4cb

                        SHA256

                        3fd167fccd6a4da4f821a66240ee4e7d352bfdcfccfddd63999a4edd1722e4e8

                        SHA512

                        df100c1ccd03e5d560c5fcaf2ace916efb7e8a26995f09f91b16c7cc999f4f09ee23981d42d40204a65069aba72680df0d70536136d1c84e3097eb0e06ab82ef

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        1f0c010e59fc29cb3874baf949962eff

                        SHA1

                        768270b22f566120d381be54102ed62dc46d5024

                        SHA256

                        208af70c30ff13d7530592026988e5b367252d2a9b078f3af95df46f8ca08919

                        SHA512

                        302aa97f9e3478fcf67b70b3b25054b8782b6af48850c5ad3e2b59114a6719f2c581bb6c76ea7098a42bc0997f263540bc5c79470800e0b2cb590e77f51d4414

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        0cb26351bf968e77b53f157afd490e41

                        SHA1

                        284008414701c533f309342bd686d70f20825c0f

                        SHA256

                        4fac467a551a6939deb23530841ba32e1e886162e66369aa8bc0fc2dd149ac16

                        SHA512

                        62e20bdfc42090df543656507b66f8fbad920eb61ad8f3ce6c8f411213d1836b0c8396c00895b08fb200a9c1a6b2fe174e26277fe9dbf67c4a39453dbc7bfdd2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js
                        Filesize

                        6KB

                        MD5

                        18685846d34c035f05d6de65973e71f8

                        SHA1

                        35a804840d20744dfc136f610e5fa1637795d84f

                        SHA256

                        f92788a45abbff2e35b99bc848feb9d0b2f3b530bdd2c2f7cca7c62e866f6fd4

                        SHA512

                        2daae98f432b5c196186f608a97f74c777abf7a3355f5eb1ec66a45dff332c81931296323357d41c9a1825675ff97ab7ffd293e668337b12b9f7b1b656af44ce

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\sessionstore-backups\recovery.jsonlz4
                        Filesize

                        4KB

                        MD5

                        9682bc12c61bbaefa96ebbf425f6ca13

                        SHA1

                        0f43db57f0756a9f073a392b790faf3c80ac7c10

                        SHA256

                        f0f18bfcf07691e21c99eb3784cf5f176993b015ab30aa3eac650ade8c4dcf08

                        SHA512

                        27f99ca591c33a3f644d5c2f2970c32795f24d97cf935e6a863e6cd4072ca4a7a08f4e32f155e0b9929fa701ee26b5cafdd2e93e64081f5f3375321ae0f1bc1e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\c9rrMHmaPi.exe
                        Filesize

                        393KB

                        MD5

                        7d7366ab79d6d3d8d83d13a8b30de999

                        SHA1

                        75c6c49a6701d254c3ce184054a4a01329c1a6f3

                        SHA256

                        3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465

                        SHA512

                        64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\lcnRyr8Vnr.exe
                        Filesize

                        602KB

                        MD5

                        e4fc58d334930a9d6572c344e5129f6b

                        SHA1

                        d38fbd0c4c86eee14722f40cc607e2128c01b00f

                        SHA256

                        973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a

                        SHA512

                        a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59

                        Download Submit

                      • \ProgramData\mozglue.dll
                        Filesize

                        593KB

                        MD5

                        c8fd9be83bc728cc04beffafc2907fe9

                        SHA1

                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                        SHA256

                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                        SHA512

                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                        Download Submit

                      • \ProgramData\nss3.dll
                        Filesize

                        2.0MB

                        MD5

                        1cc453cdf74f31e4d913ff9c10acdde2

                        SHA1

                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                        SHA256

                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                        SHA512

                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                        Download Submit

                      • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        Filesize

                        1.8MB

                        MD5

                        2d19492cf956ebf1ce662e5912b07367

                        SHA1

                        dea9da4251fefcf2d49759177f89675fb4ed32b9

                        SHA256

                        45fb50b593faf530aa26cfd2e5ba7e3b0744ae9b7e6921c6aa8021ed7f90f452

                        SHA512

                        ae1649fff4f87322a54c6394e1ebd0439201648bc88fd5f9984bd0e88ef690c16c5957f18afd4b290a435f8778cd9f96328c2ab570b5dfd5c834fcae25c0b749

                        Download Submit

                      • memory/668-164-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                        Filesize

                        972KB

                        Download

                      • memory/668-126-0x0000000000950000-0x0000000000BB1000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/668-345-0x0000000000950000-0x0000000000BB1000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/876-40-0x00000000009A7000-0x00000000009A8000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1284-407-0x00000000009C0000-0x0000000001064000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1284-383-0x00000000009C0000-0x0000000001064000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1284-344-0x00000000009C0000-0x0000000001064000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1284-147-0x00000000009C0000-0x0000000001064000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1356-254-0x0000000000BB0000-0x0000000000C04000-memory.dmp

                        Filesize

                        336KB

                        Download

                      • memory/1784-424-0x0000000006CB0000-0x0000000007354000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1784-239-0x0000000000AF0000-0x0000000000FA7000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1784-416-0x0000000000AF0000-0x0000000000FA7000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1784-423-0x0000000006CB0000-0x0000000007354000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1784-402-0x0000000006CB0000-0x0000000007149000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1784-428-0x0000000006CB0000-0x0000000007149000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1784-907-0x0000000006690000-0x00000000068F1000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/1784-902-0x0000000006690000-0x00000000068F1000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/1784-394-0x0000000000AF0000-0x0000000000FA7000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1784-404-0x0000000006CB0000-0x0000000007149000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1784-482-0x0000000006CB0000-0x0000000007149000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1784-381-0x0000000006690000-0x00000000068F1000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/1784-684-0x0000000006CB0000-0x0000000007354000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/1784-378-0x0000000006690000-0x00000000068F1000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/1804-238-0x0000000001310000-0x00000000017C7000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1804-234-0x00000000068D0000-0x0000000006D87000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1804-216-0x0000000001310000-0x00000000017C7000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/1880-405-0x00000000009E0000-0x0000000000E79000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1880-484-0x00000000009E0000-0x0000000000E79000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/2068-265-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2068-261-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2068-266-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2068-263-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2068-259-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2068-267-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2068-268-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2068-257-0x0000000000400000-0x0000000000452000-memory.dmp

                        Filesize

                        328KB

                        Download

                      • memory/2140-360-0x00000000008A0000-0x00000000009B8000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/2140-369-0x0000000009FC0000-0x000000000A044000-memory.dmp

                        Filesize

                        528KB

                        Download

                      • memory/2236-485-0x0000000000E50000-0x00000000012A0000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/2236-486-0x0000000000E50000-0x00000000012A0000-memory.dmp

                        Filesize

                        4.3MB

                        Download

                      • memory/2452-380-0x00000000066A0000-0x0000000006B57000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-22-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-343-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-888-0x00000000067C0000-0x0000000006A21000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/2452-17-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-144-0x0000000007010000-0x00000000076B4000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/2452-146-0x0000000007010000-0x00000000076B4000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/2452-20-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-19-0x0000000000061000-0x000000000008F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2452-214-0x00000000066A0000-0x0000000006B57000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-123-0x00000000067C0000-0x0000000006A21000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/2452-125-0x00000000067C0000-0x0000000006A21000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/2452-122-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-23-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-56-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-57-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2452-312-0x0000000007010000-0x00000000076B4000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/2452-889-0x00000000067C0000-0x0000000006A21000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/2452-481-0x0000000000060000-0x0000000000512000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2672-89-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-75-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-79-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-85-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-77-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-88-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-87-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2672-90-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-81-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-104-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2672-83-0x0000000000400000-0x0000000000531000-memory.dmp

                        Filesize

                        1.2MB

                        Download

                      • memory/2688-500-0x0000000069CC0000-0x000000006A377000-memory.dmp

                        Filesize

                        6.7MB

                        Download

                      • memory/2736-2-0x00000000009E1000-0x0000000000A0F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2736-0-0x00000000009E0000-0x0000000000E92000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2736-3-0x00000000009E0000-0x0000000000E92000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2736-5-0x00000000009E0000-0x0000000000E92000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2736-16-0x00000000009E0000-0x0000000000E92000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2736-1-0x00000000771B0000-0x00000000771B2000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2736-18-0x0000000006B60000-0x0000000007012000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2736-10-0x00000000009E0000-0x0000000000E92000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/2748-45-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2748-43-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2748-50-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2748-41-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2748-48-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2748-47-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2748-42-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2748-44-0x0000000000400000-0x0000000000463000-memory.dmp

                        Filesize

                        396KB

                        Download

                      • memory/2784-127-0x00000000002A0000-0x0000000000308000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/2836-382-0x00000000008B0000-0x0000000000B11000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/2836-379-0x00000000008B0000-0x0000000000B11000-memory.dmp

                        Filesize

                        2.4MB

                        Download

                      • memory/2888-427-0x00000000011C0000-0x0000000001864000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/3008-128-0x0000000001030000-0x00000000010CC000-memory.dmp

                        Filesize

                        624KB

                        Download

                      • memory/3064-342-0x0000000000F10000-0x0000000000F18000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/3576-633-0x0000000009F20000-0x0000000009FA4000-memory.dmp

                        Filesize

                        528KB

                        Download

                      • memory/3576-627-0x0000000000E70000-0x0000000000F88000-memory.dmp

                        Filesize

                        1.1MB

                        Download